TCC Bypass via Mounted APFS Snapshot Access

 1[metadata]
 2creation_date = "2020/01/04"
 3integration = ["endpoint"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots
13as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file
14system, including all user data and files protected by Apple’s privacy framework (TCC).
15"""
16from = "now-9m"
17index = ["auditbeat-*", "logs-endpoint.events.*"]
18language = "kuery"
19license = "Elastic License v2"
20name = "TCC Bypass via Mounted APFS Snapshot Access"
21references = ["https://theevilbit.github.io/posts/cve_2020_9771/"]
22risk_score = 73
23rule_id = "b00bcd89-000c-4425-b94c-716ef67762f6"
24severity = "high"
25tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Use Case: Vulnerability", "Data Source: Elastic Defend"]
26timestamp_override = "event.ingested"
27type = "query"
28
29query = '''
30event.category:process and host.os.type:macos and event.type:(start or process_started) and process.name:mount_apfs and
31  process.args:(/System/Volumes/Data and noowners)
32'''
33
34
35[[rule.threat]]
36framework = "MITRE ATT&CK"
37[[rule.threat.technique]]
38id = "T1006"
39name = "Direct Volume Access"
40reference = "https://attack.mitre.org/techniques/T1006/"
41
42
43[rule.threat.tactic]
44id = "TA0005"
45name = "Defense Evasion"
46reference = "https://attack.mitre.org/tactics/TA0005/"